Looking for advice for self hosted networking.

Question first, details below:

Everything works fine now, but feels…hacky. My question is, what’s the best way of dealing with allowing only certain services to be accessible to the world while blocking other services to everything except local (+vpn) clients? Currently, because of my vps port forwarding, all external traffic appears to come from that machine. So, what I have now in my nginx config is to allow traffic from the local & wireguard subnets, except for traffic from the vps itself.

So: looking for advice on how to better manage access, but of course, if anyone has other improvements/suggestions, I’m all ears.

My current setup is:

Machines:

  • VPS (vps) with public IP.
  • Home router (router) with no public IP or open ports.
  • Home server (srv-home).
  • Remote server (srv-remote), located with family.

Network structure, ignoring vlans and whatnot, is:

  • vps <–wireguard–> router
  • vps <–wireguard–> srv-remote
  • router <–ethernet–> srv-home

srv-remote and srv-home can communicate through vps+router.

Services & structure, broadly speaking:

vps port forwards http/s to router, which port forwards to srv-home (can optionally have it port forward directly to srv-home, doesn’t really matter to me).

srv-home handles SSL, both for services on srv-home and srv-remote. This allows me to a) manage certificates locally in one place (not on vps), and b) use local DNS on my router to bypass vps for locally hosted services. Works great.

srv-home and srv-remote both host some services which I would like to be publically accessible and some that I would like to remain private.

vps also acts as my roadwarrior vpn, on the same wireguard interface that’s used for the vps<–>router link. One solution would be to just have separate wireguard interfaces (or maybe just separate address spaces?) for the vps<–>router and vps<–>[roadwarrior] links? Another would be to get the vps portforwarding set up in a way that doesn’t lose originating IP address, but so far I have been unsuccessful there.

Thanks in advance for any insight!

  • Matt The HorwoodEnglish
    6•11 months ago

    I would move the SSL to your VPS, make that your nginx entry point.

    Then use virtual servers in nginx to listen on the wiregiard nic for local stuff and it’s public IP for internet accessible stuff, you could also add in some Auth service for things without MFA.

    • @qjkxbmwvz@lemmy.sdf.orgOPEnglish
      1•11 months ago

      So in order to access from local network (useful for e.g. photo uploading as it is way faster) would you just handle SSL locally too? So, SSL on VPS+SSL on local server (with only one being used per client of course)?